News for hackers. Stuff that matters.

A comment on CSRF is really dead. Parent comment

Re:CSRF is really dead by AmericanChopper on Saturday September 07, 2019 @06:01PM (#20906843)
That sounds more like an integrity check than a CSRF control. Unless you have poor CORs settings, wouldn’t SOP prevent CSRF on PATCH endpoints anyway?
[ Parent | on HN ]
Re:CSRF is really dead by edoceo on Saturday September 07, 2019 @06:20PM (#20906982)
It's that too. My point (still) being that passing state keys is old, common and still in use.
[ Parent | on HN ]